Bug 2368956 (CVE-2025-48734)
| Summary: | CVE-2025-48734 commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aazores, abrianik, adupliak, anthomas, aprice, aschwart, asoldano, ataylor, bbaranow, bmaxwell, boliveir, brian.stansberry, carogers, caswilli, ccranfor, cdewolf, chfoley, cmah, cmiranda, csutherl, darran.lofthouse, dbruscin, dhanak, dkreling, dnakabaa, dosoudil, drosa, dsoumis, eaguilar, ebaron, ehelms, erezende, eric.wittmann, fjuma, fmariani, fmongiar, ggainey, ggrzybek, gmalinko, gtanzill, haoli, hkataria, ibek, istudens, ivassile, iweiss, jajackso, janstey, jbuscemi, jcammara, jcantril, jclere, jmitchel, jneedle, jnethert, joehler, jolong, jpechane, jpoth, jrokos, jsamir, juwatts, kaycoth, kegrant, kholdawa, koliveir, kshier, kvanderr, kverlaen, lcouzens, lgao, mabashia, mhulan, mnovotny, mosmerov, mposolda, mskarbek, msochure, msvehla, nipatil, nmoumoul, nwallace, oezr, osousa, pantinor, parichar, pberan, pbizzarr, pbohmill, pbraun, pcongius, pcreech, pdelbell, periklis, pesilva, pjindal, plodge, pmackay, porcelli, rchan, rguimara, rkieley, rkubis, rmartinc, rmaucher, rojacob, rstancel, rstepani, sausingh, sfroberg, shvarugh, simaishi, smaestri, smallamp, smcdonal, ssilvert, stcannon, sthorger, swoodman, szappis, tasato, tcunning, teagle, tfister, thavo, tmalecek, tom.jenkinson, vmuzikar, yfang, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Apache Commons BeanUtils. This vulnerability allows remote attackers to execute arbitrary code via uncontrolled access to the declaredClass property on Java enum objects, which can expose the class loader when property paths are passed from external sources to methods like getProperty() or getNestedProperty().
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2369094, 2369088, 2369089, 2369090, 2369091, 2369092, 2369093, 2369095 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2025-05-28 14:01:19 UTC
This issue has been addressed in the following products: Cryostat 4 on RHEL 9 Via RHSA-2025:8265 https://access.redhat.com/errata/RHSA-2025:8265 This issue has been addressed in the following products: Red Hat Build of Apache Camel 4.10 for Quarkus 3.20 Via RHSA-2025:8919 https://access.redhat.com/errata/RHSA-2025:8919 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:9114 https://access.redhat.com/errata/RHSA-2025:9114 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Via RHSA-2025:9115 https://access.redhat.com/errata/RHSA-2025:9115 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4.22 Via RHSA-2025:9117 https://access.redhat.com/errata/RHSA-2025:9117 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2025:9166 https://access.redhat.com/errata/RHSA-2025:9166 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:9318 https://access.redhat.com/errata/RHSA-2025:9318 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2025:9696 https://access.redhat.com/errata/RHSA-2025:9696 This issue has been addressed in the following products: Red Hat build of Apache Camel 4.10.3 for Spring Boot 3.4.7 Via RHSA-2025:9697 https://access.redhat.com/errata/RHSA-2025:9697 This issue has been addressed in the following products: Streams for Apache Kafka 2.9.1 Via RHSA-2025:9922 https://access.redhat.com/errata/RHSA-2025:9922 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Via RHSA-2025:10453 https://access.redhat.com/errata/RHSA-2025:10453 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Via RHSA-2025:10452 https://access.redhat.com/errata/RHSA-2025:10452 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 8.0.8 Via RHSA-2025:10459 https://access.redhat.com/errata/RHSA-2025:10459 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2025:10814 https://access.redhat.com/errata/RHSA-2025:10814 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Via RHSA-2025:10926 https://access.redhat.com/errata/RHSA-2025:10926 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Via RHSA-2025:10925 https://access.redhat.com/errata/RHSA-2025:10925 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Via RHSA-2025:10924 https://access.redhat.com/errata/RHSA-2025:10924 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.4.23 Via RHSA-2025:10931 https://access.redhat.com/errata/RHSA-2025:10931 This issue has been addressed in the following products: Streams for Apache Kafka 3.0.0 Via RHSA-2025:12511 https://access.redhat.com/errata/RHSA-2025:12511 This issue has been addressed in the following products: Red Hat AMQ Broker 7.13.1 Via RHSA-2025:13274 https://access.redhat.com/errata/RHSA-2025:13274 This issue has been addressed in the following products: OCP-Tools-4.18-RHEL-9 Via RHSA-2025:15810 https://access.redhat.com/errata/RHSA-2025:15810 This issue has been addressed in the following products: OCP-Tools-4.12-RHEL-8 Via RHSA-2025:15813 https://access.redhat.com/errata/RHSA-2025:15813 This issue has been addressed in the following products: OCP-Tools-4.13-RHEL-8 Via RHSA-2025:15815 https://access.redhat.com/errata/RHSA-2025:15815 This issue has been addressed in the following products: OCP-Tools-4.16-RHEL-9 Via RHSA-2025:15811 https://access.redhat.com/errata/RHSA-2025:15811 This issue has been addressed in the following products: OCP-Tools-4.19-RHEL-9 Via RHSA-2025:15812 https://access.redhat.com/errata/RHSA-2025:15812 This issue has been addressed in the following products: OCP-Tools-4.14-RHEL-8 Via RHSA-2025:15816 https://access.redhat.com/errata/RHSA-2025:15816 This issue has been addressed in the following products: OCP-Tools-4.15-RHEL-8 Via RHSA-2025:15817 https://access.redhat.com/errata/RHSA-2025:15817 This issue has been addressed in the following products: OCP-Tools-4.17-RHEL-9 Via RHSA-2025:15814 https://access.redhat.com/errata/RHSA-2025:15814 This issue has been addressed in the following products: Red Hat AMQ Broker 7.12.5 Via RHSA-2025:16409 https://access.redhat.com/errata/RHSA-2025:16409 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Via RHSA-2025:16668 https://access.redhat.com/errata/RHSA-2025:16668 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Via RHSA-2025:16667 https://access.redhat.com/errata/RHSA-2025:16667 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7 Via RHSA-2025:10931 https://access.redhat.com/errata/RHSA-2025:10931 This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7 Via RHSA-2025:9117 https://access.redhat.com/errata/RHSA-2025:9117 |